-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Introduce global resources checks to install and multi-stage install #2987
Conversation
Signed-off-by: Ivan Sim <ivan@buoyant.io>
'linkerd-config' config map. This ensures that multiple control planes can't be installed into different namespaces. Signed-off-by: Ivan Sim <ivan@buoyant.io>
Signed-off-by: Ivan Sim <ivan@buoyant.io>
Signed-off-by: Ivan Sim <ivan@buoyant.io>
cf5018f
to
d17ef92
Compare
Signed-off-by: Ivan Sim <ivan@buoyant.io>
d17ef92
to
a8088bb
Compare
Signed-off-by: Ivan Sim <ivan@buoyant.io>
Signed-off-by: Ivan Sim <ivan@buoyant.io>
Integration test results for cad4452: fail 😕 |
Signed-off-by: Ivan Sim <ivan@buoyant.io>
Integration test results for 6567deb: fail 😕 |
dfe93c3
to
301f252
Compare
Integration test results for 301f252: fail 😕 |
301f252
to
eab2888
Compare
Integration test results for eab2888: fail 😕 |
Signed-off-by: Ivan Sim <ivan@buoyant.io>
eab2888
to
913db94
Compare
Integration test results for 913db94: success 🎉 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
works! had some comments around interaction between linkerd install
and the healthcheckers.
also, we may want to revisit our error messaging, and how we check for existing installations. my (admittedly non-standard) workflow usually involves kubectl delete ns linkerd
prior to testing a new build. that now leaves me in this state:
$ bin/linkerd install
Linkerd has already been installed on your cluster in the linkerd namespace. Please run upgrade if you'd like to update this installation. Otherwise, use the --ignore-cluster flag.
$ bin/linkerd upgrade
× Failed to build upgrade configuration: could not fetch configs from kubernetes: configmaps "linkerd-config" not found
For troubleshooting help, visit: https://linkerd.io/upgrade/#troubleshooting
consider embellishing the check during install, to determine if Linkerd is actually installed, or just the global resources:
# linkerd namespace and configmap/linkerd-config not found, but global resources exist
$ bin/linkerd install
Global resources from an existing Linkerd installation detected:
- customresourcedefinitions/serviceprofiles.linkerd.io
- mutatingwebhookconfigurations/linkerd-proxy-injector-webhook-config
- podsecuritypolicies/linkerd-linkerd-control-plane
- validatingwebhookconfigurations/linkerd-sp-validator-webhook-config
Remove these resources, or use the --ignore-cluster flag to overwrite them.
i think this also begs the question: what's our uninstallation story? linkerd install --ignore cluster | kubectl delete -f -
?
thoughts @grampelberg ?
@siggy I think it is time for an |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changes look great! 👏
While testing install
, it was indeed clear the necessity to see the full list of offending resources.
#2954 mentions an additional check for the webhook config's service namespace; will that be tackled in a separate PR?
func (hc *HealthChecker) checkClusterRoles(shouldExist bool) error { | ||
options := metav1.ListOptions{ | ||
LabelSelector: k8s.ControllerNSLabel, | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It might be worth moving this into a global var given it's used multiple times.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
At this point, I prefer to keep this close to where it's used. As this is a big file, I'm reluctant to make this variable (which is used only by a handful of methods) a global, and am willing to live with a bit of redundancy.
Signed-off-by: Ivan Sim <ivan@buoyant.io>
@alpeb Appreciate the feedback!
👍 I will surface those information.
Probably not going to do it, as it requires the user running |
Signed-off-by: Ivan Sim <ivan@buoyant.io>
58e4ab3
to
081ce1c
Compare
Integration test results for 081ce1c: fail 😕 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is working great, and these new resource-aware check outputs are super helpful. most of my comments were around formatting of output and error messages.
Signed-off-by: Ivan Sim <ivan@buoyant.io>
Integration test results for 5c488b0: success 🎉 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
great work! 🚢 👍
This PR introduces the following two new checks to
pkg/healthcheck/healthcheck.go
:LinkerdPreInstallGlobalResourcesChecks
which checks for the existence of Linkerd global resources when user runslinkerd check --pre
. The check fails if any of the Linkerd cluster roles, cluster role bindings, mutating webhook configuration, validating webhook configuration, custom resource definition or pod security policy exist. This error will point to new troubleshooting documentation informing the user that multi control plane setup isn't supported.LinkerdConfigNotExistsChecks
which checks if thelinkerd-config
config map exists. The check fails if the config map already exists. This error will point to new troubleshooting documentation informing the user can't install a control plane in the specified namespace, unless overridden with the--ignore-cluster
option.The checks use the
linkerd.io/control-plane-ns
label to select the resources. See #2971.The following are updates to install and multi-stage install:
Previously,
linkerd install
checks for existence of thelinkerd-config
config map to determine if the control plane installation is permitted. This is now changed to check for the existence of global resources, to ensure user can't install the control plane into a different namespace.Previously,
linkerd install control-plane
checks for the existence of the specified control plane namespace to determine iflinkerd install config
has already been run. This is now changed to check for the existence of global resources that are installed bylinkerd install config
.Previously, the
linkerd install
code calls the Kubernetes API directly. This is now changed to delegate the API interaction topkg/healthcheck/healthcheck.go
.Test cases can be found here.
Open questions:
linkerd.io/control-plane-ns
label won't work if the existing control plane is of an older version, since the older global resources aren't labelled. Do we need to support this use case?Fixes #2954.